instantly-security-basics

# Instantly Security Basics ## Overview Secure your Instantly.ai integration with scoped API keys, least-privilege access, secret management, webhook validation, and audit logging. Instantly API v2 uses Bearer token auth with granular scope-based permissions. ## Prerequisites - Instantly account with API access - Understanding of environment variable management - Access to Instantly dashboard Settings > Integrations ## Instructions ### Step 1: Least-Privilege API Key Scopes Create separate API keys for different use cases with minimal required scopes. ```typescript // Key scopes follow the pattern: resource:action // resource = campaigns, accounts, leads, etc. // action = read, update, all // Read-only analytics dashboard // Scopes needed: campaigns:read, accounts:read const ANALYTICS_KEY_SCOPES = ["campaigns:read", "accounts:read"]; // Campaign automation bot // Scopes needed: campaigns:all, leads:all const AUTOMATION_KEY_SCOPES = ["campaigns:all", "leads:all"]; // Webhook-only integration // Scopes needed: leads:read (to look up lead data on events) const WEBHOOK_KEY_SCOPES = ["leads:read"]; // AVOID: all:all gives unrestricted access — dev/test only ``` | Use Case | Recommended Scopes | Risk Level | |----------|-------------------|------------| | Analytics dashboard | `campaigns:read`, `accounts:read` | Low | | Lead import tool | `leads:update` | Medium | | Campaign launcher | `campaigns:all`, `leads:all`, `accounts:read` | High | | Full automation | `all:all` | ...